CVE-2022-20950

A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a lack of error-checking when SIP bidirectional flows are being inspected by Snort 3. An attacker could exploit this vulnerability by sending a stream of crafted SIP traffic through an interface on the targeted device. A successful exploit could allow the attacker to trigger a restart of the Snort 3 process, resulting in a denial of service (DoS) condition.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-dos-A4cHeArC

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:::::::*
	cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:::::::*

History

No history.

Information

Published : 2022-11-15 21:15

Updated : 2024-01-25 17:15

NVD link : CVE-2022-20950

Mitre link : CVE-2022-20950

CVE.ORG link : CVE-2022-20950

JSON object : View

Products Affected

cisco

firepower_threat_defense

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2022-20950", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-11-15T21:15:36.110", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-dos-A4cHeArC", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-754"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart.\r\n\r This vulnerability is due to a lack of error-checking when SIP bidirectional flows are being inspected by Snort 3. An attacker could exploit this vulnerability by sending a stream of crafted SIP traffic through an interface on the targeted device. A successful exploit could allow the attacker to trigger a restart of the Snort 3 process, resulting in a denial of service (DoS) condition."}, {"lang": "es", "value": "Una vulnerabilidad en la interacci\u00f3n de SIP y Snort 3 para el software Cisco Firepower Threat Defense (FTD) podr\u00eda permitir que un atacante remoto no autenticado provoque que el motor de detecci\u00f3n de Snort 3 se reinicie. Esta vulnerabilidad se debe a la falta de verificaci\u00f3n de errores cuando Snort 3 inspecciona los flujos bidireccionales SIP. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un flujo de tr\u00e1fico SIP manipulado a trav\u00e9s de una interfaz en el dispositivo objetivo. Un exploit exitoso podr\u00eda permitir al atacante reiniciar el proceso Snort 3, lo que resultar\u00eda en una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS)."}], "lastModified": "2024-01-25T17:15:21.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16FD5D12-CF1A-4990-99B3-1840EFBA5611"}, {"criteria": "cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCD2D11D-FF08-44E4-BF67-D8DD1E701FCD"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}